CVE-2025-0117: GlobalProtect Windows Privilege Escalation

CVE-2025-0117 Overview

CVE-2025-0117 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows. The flaw stems from the application relying on untrusted input for a security decision [CWE-807]. A locally authenticated, non-administrative Windows user can leverage this weakness to escalate privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS, and the GlobalProtect UWP App are not affected.

Critical Impact
Successful exploitation grants full SYSTEM-level control of the Windows host, allowing an attacker to install software, modify security controls, and access any file or credential store on the endpoint.

Affected Products

Palo Alto Networks GlobalProtect app on Windows
Non-affected: GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS
Non-affected: GlobalProtect UWP App

Discovery Timeline

2025-03-12 - CVE-2025-0117 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0117

Vulnerability Analysis

CVE-2025-0117 is a local privilege escalation issue in the GlobalProtect Windows client. The GlobalProtect service runs with SYSTEM privileges to manage VPN tunnels, certificates, and endpoint posture checks. The client component reads inputs that a low-privileged user can influence and uses those inputs to make a trust or security decision. Because the privileged service acts on values it cannot authoritatively validate, a standard Windows user can steer that decision to obtain code execution in the SYSTEM security context.

Exploitation requires local authenticated access and some user interaction, per the CVSS 4.0 vector AV:L/AC:L/PR:L/UI:P. The impact chain is limited to integrity on the vulnerable component but extends to the confidentiality, integrity, and availability of downstream subsystems (SC:H/SI:H/SA:H) because SYSTEM-level code can tamper with any protected resource on the host.

Root Cause

The root cause is classified as [CWE-807]: Reliance on Untrusted Inputs in a Security Decision. The privileged GlobalProtect Windows component consumes attacker-controllable data — such as file paths, registry values, or IPC messages — and treats it as authoritative when authorizing a privileged action. No cross-check validates the origin or integrity of that data against a trusted source.

Attack Vector

A local, non-administrative user stages input that the GlobalProtect Windows service subsequently consumes during a privileged operation. When the service acts on the manipulated input, it performs an action or loads content chosen by the attacker under the SYSTEM account. Palo Alto Networks has not published exploit code, and no public proof-of-concept is currently available. Refer to the Palo Alto Networks CVE-2025-0117 advisory for vendor-provided technical details and fixed versions.

Detection Methods for CVE-2025-0117

Indicators of Compromise

Unexpected child processes spawned by PanGPS.exe or other GlobalProtect service binaries running as NT AUTHORITY\SYSTEM.
New or modified files under GlobalProtect installation and data directories written by standard user accounts.
Registry key or configuration changes in GlobalProtect-related hives immediately preceding a SYSTEM-level process launch.

Detection Strategies

Baseline the expected process tree of the GlobalProtect service and alert on deviations, particularly SYSTEM-owned processes with a non-service parent context.
Monitor for local users creating symbolic links, junctions, or files within paths consumed by the GlobalProtect Windows client.
Correlate low-privileged user sessions with subsequent SYSTEM-level activity originating from GlobalProtect binaries.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) and forward events to a centralized analytics platform for parent-child anomaly detection.
Track file and registry access on GlobalProtect paths with Sysmon or equivalent tooling to surface untrusted input manipulation.
Alert on GlobalProtect client version drift across the fleet to identify hosts that have not yet been patched.

How to Mitigate CVE-2025-0117

Immediate Actions Required

Inventory all Windows endpoints running the GlobalProtect app and identify installed versions.
Upgrade the GlobalProtect Windows client to a fixed release as listed in the vendor advisory.
Restrict local logon rights on high-value Windows hosts to limit the population able to exploit a local flaw.
Review endpoint logs for signs of unauthorized SYSTEM-level activity tied to GlobalProtect processes.

Patch Information

Palo Alto Networks has published fixed versions and remediation guidance in the Palo Alto Networks CVE-2025-0117 advisory. Apply the vendor-supplied update to the GlobalProtect Windows client on every affected endpoint. No workaround is a substitute for the patch on Windows hosts.

Workarounds

Enforce least privilege so that only trusted users can log on interactively to systems running GlobalProtect on Windows.
Apply application control policies to prevent untrusted binaries from being written to or executed from GlobalProtect-related directories.
Increase monitoring on Windows endpoints until patching is complete across the fleet.

bash

# Enumerate GlobalProtect client versions across Windows hosts (PowerShell)
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'GlobalProtect*' } |
  Select-Object PSComputerName, Name, Version